SecurityEventsOptions Class

What a host configures once about its security-event handling: the event dictionary, signing, and - for a profile that weakens the default validation - the reasoned acknowledgement of that weakening. The pipeline itself is composed through the service collection: the default steps register as an ordinary family, and a consumer profile edits them in place through the live composition cursor after AddSecurityEvents.

public sealed class SecurityEventsOptions

Inheritance System.Object → SecurityEventsOptions

Properties

SecurityEventsOptions.AllowedSigningAlgorithms Property

The signature algorithms this deployment will sign a security event token with, and accept one under.

public string[]? AllowedSigningAlgorithms { get; set; }

Property Value

System.String[]

Exceptions

System.ArgumentException
The set is empty, or contains none.

Remarks

One set for both directions on purpose. A deployment that widens what it accepts and not what it emits, or the reverse, has two policies to keep in step and no place that says they disagree.

The DEFAULT is RS256 alone, which two specifications independently arrive at: the CAEP Interoperability Profile 1.0 draft 01 Section 2.6 requires it of security events, and OpenID Back-Channel Logout 1.0 Section 2.6 names it as the default for a Logout Token. It is also what this server's own logout tokens carry unless a client registered otherwise, so the two ends of a deployment that uses only our own pieces agree without anybody configuring anything.

WIDENING is the host's move, and the host that has to make it is the one that already knows why: this verifier is shared, so AddBackChannelLogoutReceiver resolves the same one, and a deployment whose clients registered ES256 or PS256 as their id_token_signed_response_alg must name those here. Of the FAPI 2.0 direction this library offers PS256 and ES256; EdDSA it does not implement, so naming that would name an algorithm nothing can use.

The refusal such a host meets names the algorithm that was rejected AND the set that would have been accepted, so the way out is readable from the message with no configuration in front of you. It arrives as SignatureInvalid, which RFC 8935 Section 2.4 renders on the wire as invalid_key - a key "unacceptable to the SET Recipient", which is what this is.

What the set cannot contain is none: an unsigned security event is not a weaker signature but the absence of one, and a set that could hold it would make the receiver's RequireSignedTokens the only thing standing between a deployment and an unauthenticated event.

NULL means the default, and the default is deliberately not the property's initial value: the configuration binder reads whatever is there, ADDS the configured entries and writes the result back, so a deployment narrowing the list to ES256 would get ES256 alongside everything the default carried and would believe it had excluded the rest. Measured on both a set and an array - the binder unions either. With nothing there, what it writes back is exactly what was configured. DefaultSigningAlgorithms is public so a host can still read what null means.

The value is copied in BOTH directions, and one direction alone is worth nothing: a caller holding the array it passed could add none to it afterwards, and a caller reading the property back could write into what it got. Both reach the resolved signer, which asks the array live - measured, a write through the getter made it sign PS256 under an RS256-only policy. An invariant a caller can break after assignment is not one, in either direction.

SecurityEventsOptions.DefaultSigningAlgorithms Property

What AllowedSigningAlgorithms means when a host has set nothing: RS256 alone.

public static System.Collections.Generic.IReadOnlyList<string> DefaultSigningAlgorithms { get; }

Property Value

System.Collections.Generic.IReadOnlyList<System.String>

SecurityEventsOptions.Events Property

The event dictionary: which event identifier URIs deserialize into which payload models. An event dictionary package is a set of calls against this registry.

public Abblix.SecurityEvents.Events.EventTypeRegistry Events { get; }

Property Value

EventTypeRegistry

SecurityEventsOptions.SigningKeySource Property

Supplies the private key each signing uses - the one thing a transmitter must configure and a pure receiver never does. Left null, resolving the signer fails loudly naming this property, instead of a transmitter discovering at first delivery that it signs nothing.

public System.Func<System.Threading.CancellationToken,System.Threading.Tasks.Task<Abblix.Jwt.JsonWebKey>>? SigningKeySource { get; set; }

Property Value

System.Func<System.Threading.CancellationToken,System.Threading.Tasks.Task<JsonWebKey>>